CVE-2018-21033

Severity Score

6.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability in Hitachi Command Suite prior to 8.6.2-00, Hitachi Automation Director prior to 8.6.2-00 and Hitachi Infrastructure Analytics Advisor prior to 4.2.0-00 allow authenticated remote users to load an arbitrary Cascading Style Sheets (CSS) token sequence. Hitachi Command Suite includes Hitachi Device Manager, Hitachi Tiered Storage Manager, Hitachi Replication Manager, Hitachi Tuning Manager, Hitachi Global Link Manager and Hitachi Compute Systems Manager.

Una vulnerabilidad en Hitachi Command Suite versiones anteriores a 8.6.2-00, Hitachi Automation Director versiones anteriores a 8.6.2-00 y Hitachi Infrastructure Analytics Advisor versiones anteriores a 4.2.0-00, permiten a usuarios autenticados remotos cargar secuencia de tokens de tipo Cascading Style Sheets (CSS) arbitrarias. Hitachi Command Suite incluye Hitachi Device Manager, Hitachi Tiered Storage Manager, Hitachi Replication Manager, Hitachi Tuning Manager, Hitachi Global Link Manager y Hitachi Compute Systems Manager.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-12-11 CVE Reserved
2020-02-14 CVE Published
2023-03-08 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (2)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://www.hitachi.co.jp/Prod/comp/soft1/global/security	2020-02-27
https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2019-128	2020-02-27

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Hitachi Search vendor "Hitachi"	Device Manager Search vendor "Hitachi" for product "Device Manager"	< 8.6.2-00 Search vendor "Hitachi" for product "Device Manager" and version " < 8.6.2-00"	-	Affected	in	Linux Search vendor "Linux"	Linux Kernel Search vendor "Linux" for product "Linux Kernel"	-	-	Safe
Hitachi Search vendor "Hitachi"	Device Manager Search vendor "Hitachi" for product "Device Manager"	< 8.6.2-00 Search vendor "Hitachi" for product "Device Manager" and version " < 8.6.2-00"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe
Hitachi Search vendor "Hitachi"	Device Manager Search vendor "Hitachi" for product "Device Manager"	< 8.6.2-00 Search vendor "Hitachi" for product "Device Manager" and version " < 8.6.2-00"	-	Affected	in	Oracle Search vendor "Oracle"	Solaris Search vendor "Oracle" for product "Solaris"	-	-	Safe
Hitachi Search vendor "Hitachi"	Compute Systems Manager Search vendor "Hitachi" for product "Compute Systems Manager"	< 8.6.2-00 Search vendor "Hitachi" for product "Compute Systems Manager" and version " < 8.6.2-00"	-	Affected	in	Linux Search vendor "Linux"	Linux Kernel Search vendor "Linux" for product "Linux Kernel"	-	-	Safe
Hitachi Search vendor "Hitachi"	Compute Systems Manager Search vendor "Hitachi" for product "Compute Systems Manager"	< 8.6.2-00 Search vendor "Hitachi" for product "Compute Systems Manager" and version " < 8.6.2-00"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe
Hitachi Search vendor "Hitachi"	Automation Director Search vendor "Hitachi" for product "Automation Director"	< 8.6.2-00 Search vendor "Hitachi" for product "Automation Director" and version " < 8.6.2-00"	-	Affected	in	Linux Search vendor "Linux"	Linux Kernel Search vendor "Linux" for product "Linux Kernel"	-	-	Safe
Hitachi Search vendor "Hitachi"	Automation Director Search vendor "Hitachi" for product "Automation Director"	< 8.6.2-00 Search vendor "Hitachi" for product "Automation Director" and version " < 8.6.2-00"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe
Hitachi Search vendor "Hitachi"	Tiered Storage Manager Search vendor "Hitachi" for product "Tiered Storage Manager"	< 8.6.2-00 Search vendor "Hitachi" for product "Tiered Storage Manager" and version " < 8.6.2-00"	-	Affected	in	Linux Search vendor "Linux"	Linux Kernel Search vendor "Linux" for product "Linux Kernel"	-	-	Safe
Hitachi Search vendor "Hitachi"	Tiered Storage Manager Search vendor "Hitachi" for product "Tiered Storage Manager"	< 8.6.2-00 Search vendor "Hitachi" for product "Tiered Storage Manager" and version " < 8.6.2-00"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe
Hitachi Search vendor "Hitachi"	Replication Manager Search vendor "Hitachi" for product "Replication Manager"	< 8.6.2-00 Search vendor "Hitachi" for product "Replication Manager" and version " < 8.6.2-00"	-	Affected	in	Linux Search vendor "Linux"	Linux Kernel Search vendor "Linux" for product "Linux Kernel"	-	-	Safe
Hitachi Search vendor "Hitachi"	Replication Manager Search vendor "Hitachi" for product "Replication Manager"	< 8.6.2-00 Search vendor "Hitachi" for product "Replication Manager" and version " < 8.6.2-00"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe
Hitachi Search vendor "Hitachi"	Tuning Manager Search vendor "Hitachi" for product "Tuning Manager"	< 8.6.2-00 Search vendor "Hitachi" for product "Tuning Manager" and version " < 8.6.2-00"	-	Affected	in	Linux Search vendor "Linux"	Linux Kernel Search vendor "Linux" for product "Linux Kernel"	-	-	Safe
Hitachi Search vendor "Hitachi"	Tuning Manager Search vendor "Hitachi" for product "Tuning Manager"	< 8.6.2-00 Search vendor "Hitachi" for product "Tuning Manager" and version " < 8.6.2-00"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe
Hitachi Search vendor "Hitachi"	Global Link Manager Search vendor "Hitachi" for product "Global Link Manager"	< 8.6.2-00 Search vendor "Hitachi" for product "Global Link Manager" and version " < 8.6.2-00"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe
Hitachi Search vendor "Hitachi"	Infrastructure Analytics Advisor Search vendor "Hitachi" for product "Infrastructure Analytics Advisor"	< 4.2.0-00 Search vendor "Hitachi" for product "Infrastructure Analytics Advisor" and version " < 4.2.0-00"	-	Affected	in	Linux Search vendor "Linux"	Linux Kernel Search vendor "Linux" for product "Linux Kernel"	-	-	Safe
Hitachi Search vendor "Hitachi"	Infrastructure Analytics Advisor Search vendor "Hitachi" for product "Infrastructure Analytics Advisor"	< 4.2.0-00 Search vendor "Hitachi" for product "Infrastructure Analytics Advisor" and version " < 4.2.0-00"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe